Add configuration option to set initial password expiration

Add a new per-instance configuration option to set the password
expiration time for newly-created principals.  Be aware that this only
controls the initial expiration period.  After the first password
change, further expiration periods are normally controlled by the KDC
configuration or policy.

diff --git a/NEWS b/NEWS
index 21798a2801e84cb64922d095a4599e009c7b9a1c..94b12a174fdf76d3ad26d5aa0019a3a8972c0dbc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,13 @@
                     User-Visible kadmin-remctl Changes
 
+kadmin-remctl 3.6 (unreleased)
+
+    Add a new per-instance configuration option to set the password
+    expiration time for newly-created principals.  Be aware that this only
+    controls the initial expiration period.  After the first password
+    change, further expiration periods are normally controlled by the KDC
+    configuration or policy.
+
 kadmin-remctl 3.5 (2013-10-10)
 
     Increase the timeout for initial authentication during a kpasswd

diff --git a/kadmin-backend b/kadmin-backend
index 37094be2e2803d4ea431234df962b17e8db23cf0..fcb8b8d53a29b0852b1c4592686afc67cc1864c7 100755 (executable)
--- a/kadmin-backend
+++ b/kadmin-backend
@@ -4,7 +4,7 @@
 #
 # Written by Russ Allbery <rra@stanford.edu>
 # Based heavily on work by Roland Schemers
-# Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013
+# Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -281,6 +281,11 @@ sub kadmin_create {
     if ($status ne 'enabled') {
         $command .= ' -allow_tix';
     }
+    if ($CONFIG{$instance}{expiration}) {
+        my $expiration = time + $CONFIG{$instance}{expiration};
+        $expiration = strftime ('%Y-%m-%d %T', localtime $expiration);
+        $command .= ' -pwexpire "$expiration"';
+    }
     if (exists $CONFIG{$instance}{create_opts}) {
         $command .= ' ' . $CONFIG{$instance}{create_opts};
     }
@@ -1648,6 +1653,11 @@ Contains extra options to pass to the B<kadmin> C<addprinc> command when
 creating a new principal.  These can be any valid flags to the C<addprinc>
 command.
 
+=item expiration
+
+If set, the number of seconds into the future at which the password for a
+newly-created account should expire.
+
 =item k5_admin
 
 Principal to use for authentication of Kerberos v5 B<kadmin> operations.
@@ -1797,8 +1807,8 @@ Russ Allbery <rra@stanford.edu>, based heavily on work by Roland Schemers.
 
 =head1 COPYRIGHT AND LICENSE
 
-Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013 The Board of Trustees
-of the Leland Stanford Junior University
+Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013, 2014 The Board of
+Trustees of the Leland Stanford Junior University
 
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index bcc68dcea606c2ce7c803b7460bb2456d135db38..8d83a59a9f5aa59eeeded7544cd27a1a19af8383 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -5,7 +5,7 @@
 # Written by Russ Allbery <rra@stanford.edu>
 # Heimdal port written by Jon Robertson <jonrober@stanford.edu>
 # Based heavily on work by Roland Schemers
-# Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013
+# Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -291,6 +291,12 @@ sub kadmin_create {
     }
     $princdata->setAttributes ($attrs);
 
+    # Set a password expiration if we were told to.
+    if ($CONFIG{$instance}{expiration}) {
+        my $expiration = time + $CONFIG{$instance}{expiration};
+        $princdata->setPwExpiration ($expiration);
+    }
+
     if (!eval { $kadmin->createPrincipal ($princdata, $password, 0) }) {
         my $error = $@ || "unknown error\n";
         warn "error: cannot create $principal: $error";
@@ -1798,6 +1804,11 @@ handled separately) or a realm.
 Set to a true value if passwords for this instance should be subject to
 password strength checking, false otherwise.
 
+=item expiration
+
+If set, the number of seconds into the future at which the password for a
+newly-created account should expire.
+
 =item k5_admin
 
 Principal to use for authentication of Kerberos B<kadmin> operations.  If
@@ -1937,7 +1948,7 @@ Original Heimdal port written by Jon Robertson <jonrober@stanford.edu>.
 
 =head1 COPYRIGHT AND LICENSE
 
-Copyright 2009, 2010, 2011, 2013 The Board of Trustees of the Leland
+Copyright 2009, 2010, 2011, 2013, 2014 The Board of Trustees of the Leland
 Stanford Junior University
 
 Permission is hereby granted, free of charge, to any person obtaining a